stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity

up
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Details
Signals CI & Image / signals-ci (push) Has been cancelled
Details
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Details
Policy Simulation / policy-simulate (push) Has been cancelled
Details
SDK Publish & Sign / sdk-publish (push) Has been cancelled
Details
AOC Guard CI / aoc-guard (push) Has been cancelled
Details
AOC Guard CI / aoc-verify (push) Has been cancelled
Details
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Details
devportal-offline / build-offline (push) Has been cancelled
Details

Browse Source
This commit is contained in:
StellaOps Bot
2025-11-25 22:09:44 +02:00
parent 6bee1fdcf5
commit 9f6e6f7fb3
116 changed files with 4495 additions and 730 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
docs/security/secrets-handling.md Normal file
View File

@@ -0,0 +1,20 @@
# Secrets Handling (Orchestrator additions)
Last updated: 2025-11-25
## Principles
- Secrets are stored in Authority and referenced via `secretRef`; services never persist raw secrets.
- No secrets in logs, traces, metrics, crash dumps, or health endpoints.
- Offline/air-gap: secrets are delivered through sealed bundles and loaded at startup only.
## Orchestrator-specific rules (DOCS-ORCH-34-002)
- Plugin steps receive secrets via `secretRef`; workers fetch at step start and keep in-memory only for the step scope.
- Secrets are not written to the run ledger, artifacts, or NDJSON exports; only `secretRef` identifiers may appear.
- Network egress is deny-by-default; allowlists must reference `secretRef`-protected credentials when needed.
- Cancellation and retries must not log or surface secret material; redaction applies to all error paths.
## Audit checklist
- [ ] Every plugin configuration uses `secretRef`, not inline values.
- [ ] Logs/traces verified to contain no secret payloads (redaction tests).
- [ ] Run ledger verified to store hashes/refs only.
- [ ] Secret refresh/rotation tested (Authority + worker reload).